CVE-2026-12079

MediumCVSS 6.5/10Last modified Jun 26, 2026

Description

The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
wedevs	Dokan Pro	<= 5.0.4

References

Timeline

Published: Jun 25, 2026
Last modified: Jun 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1207908.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207918.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207927.3Insertion of sensitive information into log file in Aspire allows an authorized attacker to disclose information locally.CVE-2026-1207965.3Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-12084.3The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.CVE-2026-120807.3A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys c CVE-2026-1208037.1A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator used by certain $setWi CVE-2026-1208047.5A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authe CVE-2026-1208054.3In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-CVE-2026-1208065.5A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a CVE-2026-1208076.6A flaw in MongoDB’s X.509 cluster-membership authentication guard could allow a holder of a cluster-member certificate to gain elevated inte CVE-2026-1208087.4An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connection